mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
3bb399cbdd
Adds the topology contract that lets a fund run mpcd as its own private
cluster — no Lux primary network registration, no shared M-Chain audit
ledger — using the same code path and the same operator surface.
Mode flag at cmd/mpcd/main.go:
--network=primary|private # registration target
--audit-store=mchain|local-worm|... # audit log destination
--registrar-url, --registrar-auth # primary-mode announcement
--audit-worm-path, --audit-mchain-url # backend selectors
pkg/audit:
- Append-only Merkle hash chain. Tampering with any historical event
invalidates every subsequent hash. Canonical bytes use fixed-order
concatenation (json.Marshal map ordering is non-deterministic).
- WORMDispatcher: NDJSON append, replay-on-start, fsync per Append.
- MChainDispatcher: batched POST of (batchHash, fromSeq, toSeq) to a
configurable anchor RPC.
- compositeDispatcher: fan-out to multiple legs with per-leg sealing.
- S3 Glacier Vault / Azure Immutable / GCS Object Lock dispatchers
fail closed — wired into the flag surface but gated behind the
cloud-audit build tag, no silent fallback.
pkg/identity/bootstrap.go: identity creation + (primary-mode only)
registrar announcement. Same on-disk format as the previous
loadOrGenerateIdentity (which is now removed); private mode is silent.
deployments/k8s-private: fund-only Kustomize overlay. Standalone
namespace, NetworkPolicy that blocks egress to anything outside the
fund's VPC, hardware-WORM PVC for the audit log, KMS-driven secret
template.
deployments/k8s-primary: env-var patch overlay on the existing lux-mpc
base. composite(local-worm,mchain) by default.
deployments/terraform/{aws,gcp,azure}: VPC + audit storage modules.
terraform validate passes; EKS/GKE/AKS + HSM modules are stubbed and
not yet plan-tested.
deployments/onprem/README.md: WORM storage + PKCS#11 HSM checklist.
Tests (14 total, all passing):
pkg/audit: 6/6 (chain, WORM replay, MChain batching, composite,
cloud stubs fail loud, double-seal rejected)
pkg/identity: 4/4 (private no-call, primary call, primary empty
URL no-op, primary registrar 503 surfaces)
internal/privatemode: 4/4 (no registrar traffic, restart, tamper-detect,
cloud stubs fail loud)
Companion runbook in lux/papers/lux-private-mpc-deployment/
(LaTeX, 5 pages, tectonic-clean).
75 lines
1.8 KiB
Terraform
75 lines
1.8 KiB
Terraform
# GCP deployment for fund-private mpcd clusters.
|
|
#
|
|
# What this module provisions (top-level):
|
|
# - GKE Autopilot cluster (private, regional, workload-identity on)
|
|
# - GCS bucket with Object Lock retention policy (audit WORM)
|
|
# - Cloud HSM key ring + key for ZapDB password wrap
|
|
# - Cloud KMS-backed secret entries
|
|
#
|
|
# Usage:
|
|
# cd deployments/terraform/gcp
|
|
# terraform init
|
|
# terraform plan -var "fund_id=acme-fund" -var "project=acme-mpc-prod" -var "region=us-central1"
|
|
# terraform apply -var "fund_id=acme-fund" -var "project=acme-mpc-prod" -var "region=us-central1"
|
|
|
|
terraform {
|
|
required_version = ">= 1.7"
|
|
required_providers {
|
|
google = {
|
|
source = "hashicorp/google"
|
|
version = ">= 5.40"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "fund_id" {
|
|
type = string
|
|
description = "Short fund identifier (lowercase, hyphenated)."
|
|
validation {
|
|
condition = can(regex("^[a-z][a-z0-9-]{2,32}$", var.fund_id))
|
|
error_message = "fund_id must be 3-33 chars, lowercase alphanumeric+hyphen."
|
|
}
|
|
}
|
|
|
|
variable "project" {
|
|
type = string
|
|
description = "GCP project ID."
|
|
}
|
|
|
|
variable "region" {
|
|
type = string
|
|
description = "GCP region."
|
|
}
|
|
|
|
provider "google" {
|
|
project = var.project
|
|
region = var.region
|
|
}
|
|
|
|
# GCS audit bucket with retention policy.
|
|
resource "google_storage_bucket" "audit" {
|
|
name = "${var.fund_id}-mpc-audit"
|
|
location = var.region
|
|
storage_class = "STANDARD"
|
|
force_destroy = false
|
|
|
|
uniform_bucket_level_access = true
|
|
public_access_prevention = "enforced"
|
|
|
|
retention_policy {
|
|
is_locked = true
|
|
retention_period = 220838400 # 7 years in seconds
|
|
}
|
|
|
|
versioning {
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
output "audit_bucket" {
|
|
value = google_storage_bucket.audit.name
|
|
}
|
|
|
|
# GKE + Cloud HSM modules elided here for the same reason as AWS:
|
|
# scope. See deployments/terraform/gcp/README.md.
|